1. Field
The present application generally relates to packet switch appliances, and, more particularly, to state-based filtering on a packet switch appliance.
2. Related Art
Packet switch appliances can be used to forward packets in a packet-switching network, based on their address information, to their destination terminals. Typically, packet switch appliances have one or more network ports for connection to the packet-switching network. The network port of a packet switch appliance can include a filter, which either drops or forwards packets. Packet switch appliances may also have one or more instrument ports connected to one or more network instruments, typically used to monitor packet traffic, such as packet sniffers, intrusion detection systems, intrusion prevention systems, or forensic recorders.
Conventional packet switch appliances typically have static filters, which use fixed values as filter criteria. Static filters can be used to filter packets used in static protocols because static protocols have fixed offsets and attributes whose values remain fixed as defined by their respective standards. For example, source or destination port 23 in the TCP header can be used as the static filter to filter telnet packets. Static filters of conventional packet switch appliances, however, are not able to perform state-based filtering because state-based protocols have some attributes whose values may be dynamically negotiated and thus change with state changes.